AWS EC2上Java REST API AES256加密问题：同明文每次加密结果不同求助

Hey Chloe, let's unpack what's going on here first: the fact that your plaintext produces different ciphertexts every time you call KMS's encrypt method is not a bug—it's a deliberate security feature of AWS KMS.

KMS automatically generates a unique data key (even when using the same CMK) and a random initialization vector (IV) for each encryption request. This prevents identical plaintexts from producing identical ciphertexts, which stops attackers from using frequency analysis to guess your data. If all you need is to reliably decrypt the ciphertext back to the original plaintext, your current code actually works perfectly—give it a test: encrypt the same string twice, then decrypt both ciphertexts, and you'll get the original plaintext both times.

But if your requirement is specifically to use PBKDF2 to derive a key, then use AES-256 for encryption/decryption, while storing the root key securely in AWS, here are two solid approaches:

Option 1: Use KMS to protect your PBKDF2 root key, handle AES-256 yourself #

This approach lets you control the PBKDF2 and AES logic while keeping your root key safe via KMS. The core idea is: encrypt your PBKDF2 root key with KMS (never store it plaintext), then decrypt it on-demand to derive your AES key for each encryption/decryption operation.

Step 1: Generate and encrypt your PBKDF2 root key with KMS #

First, create a random root key (256 bits is ideal for AES-256) and encrypt it with KMS for storage (save the encrypted version in S3, a database, or your config system—never the plaintext):

// Generate a random 256-bit root key
SecureRandom random = new SecureRandom();
byte[] rootKey = new byte[32];
random.nextBytes(rootKey);

// Encrypt the root key with KMS
EncryptRequest encryptRootKeyRequest = new EncryptRequest()
    .withKeyId(key_arn)
    .withPlaintext(ByteBuffer.wrap(rootKey));
EncryptResult encryptedRootKeyResult = client.encrypt(encryptRootKeyRequest);

// Convert encrypted root key to Base64 for storage
String encryptedRootKeyBase64 = Base64.getEncoder().encodeToString(encryptedRootKeyResult.getCiphertextBlob().array());

Step 2: Encrypt plaintext with PBKDF2-derived AES key #

We'll use AES-GCM (authenticated encryption, more secure than CBC) here. We'll generate a random salt (for PBKDF2) and IV (for AES), then bundle them with the ciphertext so we can reverse the process on decryption:

import javax.crypto.Cipher;
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.PBEKeySpec;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;
import java.security.SecureRandom;
import java.util.Base64;

public String encrypt(String text, String encryptedRootKeyBase64) {
    try {
        // 1. Decrypt the root key from KMS
        byte[] encryptedRootKeyBytes = Base64.getDecoder().decode(encryptedRootKeyBase64);
        DecryptRequest decryptRootKeyRequest = new DecryptRequest()
            .withCiphertextBlob(ByteBuffer.wrap(encryptedRootKeyBytes));
        DecryptResult decryptRootKeyResult = client.decrypt(decryptRootKeyRequest);
        
        byte[] rootKey = new byte[decryptRootKeyResult.getPlaintext().remaining()];
        decryptRootKeyResult.getPlaintext().get(rootKey);

        // 2. Derive AES key using PBKDF2
        byte[] salt = new byte[16]; // Random salt for each encryption
        new SecureRandom().nextBytes(salt);
        int iterations = 65536; // Adjust based on security/performance needs
        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        SecretKey derivedKey = factory.generateSecret(
            new PBEKeySpec(new String(rootKey).toCharArray(), salt, iterations, 256)
        );
        byte[] aesKey = derivedKey.getEncoded();

        // 3. AES-GCM encryption
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        byte[] iv = new byte[12]; // GCM recommends 12-byte IV
        new SecureRandom().nextBytes(iv);
        cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(aesKey, "AES"), new GCMParameterSpec(128, iv));
        
        byte[] ciphertext = cipher.doFinal(text.getBytes(StandardCharsets.UTF_8));

        // 4. Bundle salt, IV, and ciphertext into a single Base64 string
        String saltBase64 = Base64.getEncoder().encodeToString(salt);
        String ivBase64 = Base64.getEncoder().encodeToString(iv);
        String ciphertextBase64 = Base64.getEncoder().encodeToString(ciphertext);
        
        return String.join(":", saltBase64, ivBase64, ciphertextBase64);
    } catch (Exception e) {
        e.printStackTrace();
        return null;
    }
}

Step 3: Decrypt by reversing the process #

Split the bundled string back into salt, IV, and ciphertext, then re-derive the AES key and decrypt:

public String decrypt(String encryptedText, String encryptedRootKeyBase64) {
    try {
        // 1. Split the encrypted text into salt, IV, ciphertext
        String[] parts = encryptedText.split(":");
        byte[] salt = Base64.getDecoder().decode(parts[0]);
        byte[] iv = Base64.getDecoder().decode(parts[1]);
        byte[] ciphertext = Base64.getDecoder().decode(parts[2]);

        // 2. Decrypt root key from KMS (same as encryption step)
        byte[] encryptedRootKeyBytes = Base64.getDecoder().decode(encryptedRootKeyBase64);
        DecryptRequest decryptRootKeyRequest = new DecryptRequest()
            .withCiphertextBlob(ByteBuffer.wrap(encryptedRootKeyBytes));
        DecryptResult decryptRootKeyResult = client.decrypt(decryptRootKeyRequest);
        
        byte[] rootKey = new byte[decryptRootKeyResult.getPlaintext().remaining()];
        decryptRootKeyResult.getPlaintext().get(rootKey);

        // 3. Re-derive AES key using PBKDF2 (same parameters as encryption)
        int iterations = 65536;
        SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
        SecretKey derivedKey = factory.generateSecret(
            new PBEKeySpec(new String(rootKey).toCharArray(), salt, iterations, 256)
        );
        byte[] aesKey = derivedKey.getEncoded();

        // 4. AES-GCM decryption
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        cipher.init(Cipher.DECRYPT_MODE, new SecretKeySpec(aesKey, "AES"), new GCMParameterSpec(128, iv));
        
        byte[] plaintextBytes = cipher.doFinal(ciphertext);
        return new String(plaintextBytes, StandardCharsets.UTF_8);
    } catch (Exception e) {
        e.printStackTrace();
        return null;
    }
}

Option 2: Stick with KMS's default behavior (if PBKDF2 isn't strictly required) #

If your main goal is secure encryption/decryption and you don't absolutely need to implement PBKDF2 yourself, your original code is totally valid. KMS handles all the hard parts: random IVs, data key management, and secure encryption standards. You can verify this quickly:

// Test your original code
String testString = "Hello, KMS!";
String encrypted = encrypt(testString);
String decrypted = decrypt(encrypted);
System.out.println(decrypted.equals(testString)); // This will print true

This approach is often preferable because AWS maintains KMS's security posture, so you don't have to worry about implementing encryption correctly (which is easy to mess up).

Key Best Practices #

• Never store plaintext keys: Always use KMS to encrypt your root keys before storing them anywhere.
• Adjust PBKDF2 iterations: Higher iterations mean better security but slower performance. 65536 is a good starting point, but you can go higher if your system can handle it.
• Use AES-GCM: It provides both encryption and integrity checking, preventing tampered ciphertexts from being decrypted.
• Randomize salt and IV: Never reuse salts or IVs—this ensures identical plaintexts produce different ciphertexts, which is critical for security.

内容的提问来源于stack exchange，提问作者Chloe